Data Security Controls Guide: Why Stricter Enforcement Prevents Hacks | Tech News

What Are Data Security Controls and Why Do They Matter?

Data security controls refer to the technical and organizational measures that companies implement to protect personal information from unauthorized access, theft, or breaches. In the wake of major 2026 data breaches at Booking.com and Basic-Fit affecting over 1 million customers, Dutch digital rights organization Bits of Freedom is calling for significantly stricter enforcement of these controls. According to director Evelyn Austin, 'Without proper oversight and enforcement, companies continue to collect excessive data with inadequate protection, making hacks inevitable.' The recent incidents highlight a critical gap in how data protection regulations like GDPR are enforced in practice.

The Current Data Breach Landscape in 2026

The first quarter of 2026 has seen a troubling surge in major data breaches affecting Dutch and European companies. In April 2026, Booking.com confirmed that hackers accessed customer booking information including names, email addresses, phone numbers, and reservation details. While financial data wasn't compromised, the breach exposed sensitive travel information that could be used for sophisticated phishing attacks. Shortly after, European fitness chain Basic-Fit suffered a massive breach affecting approximately 1 million members across six countries, with 200,000 Dutch members specifically impacted. The stolen data included bank details, addresses, dates of birth, and membership information. These incidents follow previous breaches at telecom provider Odido, creating what experts call a 'data security crisis' in the Netherlands.

Bits of Freedom's Analysis of the Problem

According to Evelyn Austin, director of Bits of Freedom, the fundamental issue lies in how companies approach data collection and retention. 'The internet industry has operated for years on the belief that data equals money,' Austin explains. 'Many companies collect as much data as possible with insufficient attention to the strategic vulnerabilities this creates for their own operations.' This data hoarding mentality, combined with inadequate security measures, creates what Austin calls 'perfect conditions for hackers.' The organization points to existing GDPR requirements like data minimization, specific retention periods, and proper information management that companies often fail to implement effectively. Similar to the EU digital services act enforcement, proper oversight is crucial for compliance.

How Stricter Controls Could Prevent Future Breaches

Bits of Freedom proposes several concrete measures to strengthen data security controls and prevent future breaches:

1. Enhanced Regulatory Oversight: The Dutch Data Protection Authority (AP) needs increased resources and authority to conduct regular audits and spot checks on companies' data protection practices.
2. Proactive Enforcement Tools: Beyond financial penalties, the AP should more frequently use its power to order complete cessation of data processing activities in cases of persistent non-compliance.
3. Mandatory Data Minimization: Companies must be compelled to collect only essential data and implement automatic deletion systems for information no longer needed.
4. Transparent Breach Reporting: Organizations must provide clear, detailed information to affected individuals about what data was compromised and how they can protect themselves.

Unlike the 2025 cryptocurrency exchange hacks, these measures focus on prevention rather than reaction. 'Financial penalties alone aren't enough,' Austin emphasizes. 'When companies persistently fail to comply, regulators need the ability to stop their data processing activities entirely.'

The Role of the Dutch Data Protection Authority

The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, plays a critical role in enforcing GDPR compliance. However, the organization has long complained about insufficient funding. 'They indicate that their budget needs to increase to over €100 million in coming years, while it currently stands at just over €50 million,' Austin notes. While €50 million isn't insignificant, the AP's current resources limit its ability to conduct proactive investigations and enforce compliance effectively. The AP has several enforcement powers under GDPR including administrative fines up to €20 million or 4% of global annual turnover, periodic penalty payments, processing bans, reprimands, and formal warnings. However, according to Bits of Freedom, the authority relies too heavily on financial penalties and underutilizes its power to order complete cessation of data processing activities.

Practical Implementation Strategies

For companies looking to improve their data security controls, several practical steps can be implemented immediately:

• Regular Data Audits: Conduct comprehensive reviews of all collected data to identify unnecessary information that can be deleted.
• Purpose Limitation: Clearly define why each piece of data is collected and ensure it's directly relevant to that purpose.
• Access Controls: Implement strict access management systems that limit employee access to only necessary data.
• Retention Policies: Establish automatic deletion systems for data that has exceeded its useful lifespan.

These measures not only improve compliance but also reduce cybersecurity risks by minimizing the data available to potential hackers. As seen in the Dutch healthcare data protection sector, proper controls significantly reduce breach risks.

The Impact on Businesses and Consumers

Stricter data security controls would have significant implications for both businesses and consumers. For companies, enhanced enforcement means increased compliance costs but also reduced risk of costly breaches and reputational damage. The average cost of a data breach in 2025 exceeded €4 million according to industry reports, making prevention economically sensible. For consumers, better controls mean greater privacy protection and reduced risk of identity theft or fraud. Austin emphasizes that when breaches do occur, companies must provide clear information: 'It's crucial that affected individuals understand exactly what data was compromised, when it happened, and how they can best protect themselves. This transparency is often lacking in current breach notifications.'

Frequently Asked Questions About Data Security Controls

What is data minimization under GDPR?

Data minimization is a fundamental GDPR principle requiring organizations to collect only necessary personal data for specific, legitimate purposes and retain it only as long as needed. This reduces cybersecurity risks by minimizing data breach exposure.

How can companies implement better data security controls?

Companies should conduct regular data audits, implement strict access controls, establish clear retention periods with automatic deletion, and ensure all data collection serves specific, legitimate purposes.

What powers does the Dutch Data Protection Authority have?

The AP can impose administrative fines up to €20 million or 4% of global annual turnover, order periodic penalty payments, ban data processing activities, issue reprimands, and provide formal warnings for GDPR violations.

Why do data breaches keep happening despite GDPR?

According to Bits of Freedom, insufficient enforcement resources, companies prioritizing data collection over security, and inadequate implementation of existing regulations contribute to ongoing breaches.

What should I do if my data is compromised in a breach?

Monitor accounts for suspicious activity, change passwords, enable two-factor authentication where available, and be vigilant for phishing attempts using your personal information.

Sources

Booking.com Data Breach Report
Basic-Fit Data Breach Details
Dutch Data Protection Authority Enforcement Powers
Bits of Freedom Official Website